diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index 94af1335ec..ab0968e1e3 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -51,4 +51,4 @@ tags: context: - Source:Endpoint - Stage:Persistence - message: Safeboot registry $Registry.registry_path was added or modified with a new value $Registry.registry_value_name$ + message: Safeboot registry $Registry.registry_path$ was added or modified with a new value $Registry.registry_value_name$ diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index fa8fb39b09..2a811be0c2 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -65,7 +65,7 @@ tags: context: - Source: Endpoint - Stage: Initial Access, Execution, Defense Evasion - message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user + message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index 17c63e4b87..9ed0d2343c 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -66,7 +66,7 @@ tags: context: - Source: Endpoint - Stage: Initial Access, Execution, Defense Evasion - message: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user + message: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index 7432415a30..2eeb9ff135 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -55,7 +55,7 @@ tags: context: - Source: Endpoint - Stage: Execution - message: Unusually long command line $Processes.process_name$ on $dest + message: Unusually long command line $Processes.process_name$ on $dest$ observable: - name: dest type: Endpoint